PHONE · BIOMETRIC · LINUX
A paw of approval.¶
Approve Linux authentication on your Android phone. syauth carries a fresh challenge over Bluetooth, asks for your approval and a strong biometric, and verifies the phone's signature on your desktop.
Install the release¶
Install the desktop with curl -fsSL https://mewplane.github.io/syauth/install.sh | sh, then follow installation and setup. The published v0.2.0 assets include DEB/RPM/Arch packages for both CPU architectures, the signed Android companion, and checksums.
Follow one unlock¶
- A Linux application calls PAM. The syauth module asks the desktop daemon to challenge your bonded phone.
- The daemon sends a fresh nonce over the existing BLE connection.
- You tap Approve on the phone and complete a strong biometric prompt.
- Android Keystore signs the challenge. The daemon verifies the signature and checks its replay cache.
- PAM receives the result. The service's PAM stack decides whether to grant access or continue to another authentication method.
The animation is a teaching model, not a connection to your phone. Use Play, Next step, or Restart; playback starts paused. The steps above remain readable without JavaScript.
Find your path¶
-
Try your first approval
Follow the first unlock tutorial on a configured desktop.
-
Set up and operate
Install, pair or revoke a phone, and troubleshoot a failed approval.
-
Understand the system
Explore pairing, discovery, and unlock, then read the security boundaries.
-
Look up the details
Find commands, paths and configuration, wire formats, and the glossary.
What to expect¶
The desktop advertises; the phone connects. Being nearby prepares the channel: every unlock still needs your explicit approval and a strong biometric. Unlock does not require an Internet service.
Use Android 13 or later with a supported Ed25519 Android Keystore implementation and an enrolled strong biometric. The APK's lower installation minimum does not mean pairing works on older Android versions.
These pages describe the implementation, including its limitations. In particular, the current bond derivation is not the hybrid key exchange described in the design specification, and the desktop stores application bond material in files. Read the implementation boundaries before enabling PAM.